WordPress FULL Customer Plugin <= 2.2.3 is vulnerable to Sensitive Data Exposure

Software FULL Customer Type Plugin Vulnerable versions = 2.2.3 Fixed in 2.3 OWASP Top 10 A5: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-4242 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 83963600e826 Credits Ramuel Gall Required privilege...

WordPress FULL Customer Plugin <= 2.2.3 is vulnerable to Broken Access Control

Software FULL Customer Type Plugin Vulnerable versions = 2.2.3 Fixed in 2.3 OWASP Top 10 A6: Security Misconfiguration Classification Broken Access Control CVE CVE-2023-4243 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 72dc4e55ce85 Credits Ramuel Gall Required privile...

Citrix Hypervisor Security Bulletin for CVE-2023-20569, CVE-2023-34319 and CVE-2022-40982

Description of Problem An issue has been discovered in Citrix Hypervisor 8.2 CU1 LTSR that may allow malicious, privileged code in a guest VM to cause the host to crash. This issue has the following identifier: CVE-2023-34319 In addition, Intel has disclosed a security issue affecting certain Int...

CVE-2023-27422

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in NsThemes NS Coupon To Become Customer plugin = 1.2.2 versions...

CVE-2023-27422

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in NsThemes NS Coupon To Become Customer plugin = 1.2.2 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in NsThemes NS Coupon To Become Customer plugin = 1.2.2 versions...

WordPress plugin ns-coupon-to-become-customer cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2023-28336 · WordPress · Full - Customer

Name of the Vulnerable Software and Affected Versions: The FULL - Customer plugin for WordPress versions up to, and including, 2.2.3 Description: The issue allows authenticated attackers with subscriber-level permissions and above to execute code by installing plugins from arbitrary remote...

PT-2023-28332 · WordPress · Full - Customer

Name of the Vulnerable Software and Affected Versions: The FULL - Customer plugin for WordPress versions up to, and including, 2.2.3 Description: The issue allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as...

VulnCheck KEV: CVE-2023-4243

The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing...

PT-2023-27001 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.1.1 Description: The issue allows deletion of files from the server via the CustomerMessage API. There are no known workarounds for this problem. Recommendations: For versions prior to 8.1.1, update to version...

Microsoft mitigates Power Platform Custom Code information disclosure vulnerability

Summary On 30 March 2023, Tenable informed Microsoft under Coordinated Vulnerability Disclosure CVD of a security issue concerning Power Platform Custom Connectors using Custom Code. This feature allows customers to write code for custom connectors. This issue has been fully addressed for all...

CVE-2023-4145

Cross-site Scripting XSS - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2...

Cross site scripting

Cross-site Scripting XSS - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2...

CVE-2023-4145

CVE-2023-4145 is a stored XSS vulnerability in pimcore/customer-data-framework present in versions prior to 3.4.2. The issue stems from cross-site scripting in the Customer Data Framework that could be triggered via HTML injection in emails, potentially allowing an attacker to influence a victim’...

CVE-2023-4145 Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework

Cross-site Scripting XSS - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2...

CVE-2023-4145 Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework

Cross-site Scripting XSS - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2...

Pimcore customer-data-framework Cross-Site Scripting Vulnerability

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A cross-site scripting vulnerability exists in...

PT-2023-27953 · Pimcore · Pimcore/Customer-Data-Framework

Name of the Vulnerable Software and Affected Versions: pimcore/customer-data-framework versions prior to 3.4.2 Description: The issue is related to Cross-site Scripting XSS - Stored, which can be exploited by an attacker to trick victims into clicking on malicious hyperlinks, potentially leading ...

Moxa IKS, EDS Out-of-Bounds Read (CVE-2019-6522)

Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allow an attacker to retrieve sensitive data or cause device reboot. This plugin only works with Tenable.ot. Please visit...